Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-24790: Go 1.19 misidentifies IPv4‑mapped IPv6 addresses
CVE-2024-24790 · published 2 years ago
Summary
In Go version 1.19, the network address utilities do not correctly recognise IPv4‑mapped IPv6 addresses as private or loopback, so checks that rely on these results may give false negatives. This can cause software to treat internal or local traffic as external, potentially breaking security or routing logic. Upgrade to a newer Go version or apply the provided patch to fix the address checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | golang-1.19 | All versions |
Original advisory text
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
References
- http://www.openwall.com/lists/oss-security/2024/06/04/1 URL
- https://go.dev/cl/590316 URL
- https://go.dev/issue/67680 URL
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ URL
- https://pkg.go.dev URL
- https://pkg.go.dev/vuln/GO-2024-2887 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24790... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24790 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240905-0002/ Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2024-24790 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Timeline
Published5 Jun 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta